Shadow AI
The AI you can't see is the real risk.
When the approved tools don't fit the job, or nobody has explained what's allowed, people use whatever is in reach: personal accounts, free apps, client details pasted into a chat window. Most of the time it isn't rule-breaking. It's someone trying to get their work done.
Banning it doesn't work. What works is making the right way the easy way: a company workspace set up for the work people actually do, and plain guidance on what belongs in it and what doesn't.